@topy-ai/maggie 0.7.22 → 0.7.23

package/README.md

@@ -85,6 +85,10 @@ maggie qa assertion-audit --project . \
   --output docs/qa-assertion-audit.json
 ```
 
+For a dialog or drawer, include a browser-runtime `scroll-owner-count` check
+with `expected: 1`. This catches the fixed-shell plus inner-content double
+scrollbar that static class checks can miss.
+
 Dashboard and documentation audits are provider-neutral and keep host data
 behind explicit evidence files:
 
@@ -352,8 +356,8 @@ artifact schemas.
 Recommended upgrade sequence for the current release:
 
 ```bash
-npx @topy-ai/maggie@0.7.22 update --project . --force
-npx @topy-ai/maggie@0.7.22 cleanup --project .
+npx @topy-ai/maggie@0.7.23 update --project . --force
+npx @topy-ai/maggie@0.7.23 cleanup --project .
 ```
 
 Maintainers should pass npm credentials through the repository helper, never
@@ -363,7 +367,10 @@ as a command-line argument:
 node scripts/publish-npm.mjs --maggie-env-file ../.env
 ```
 
-The 0.7.22 workflow adds provider-catalogue authority checks, field/variant
+The 0.7.23 workflow adds the single-scroll-owner MaggieDash modal primitive,
+server-runtime-only auth/provider configuration guidance, best-effort optional
+identity-mirror semantics, and `scroll-owner-count` browser QA evidence. The
+0.7.22 workflow adds provider-catalogue authority checks, field/variant
 sync reports, separate supply/display states, site-owned slug proposals,
 withdrawal endings, retirement evidence audits, and runtime QA assertion lint.
 The 0.7.21 workflow adds operation-specific localization quality checks,

package/README.zh-TW.md

@@ -8,7 +8,7 @@ Codex、Claude Code 與相容的 coding agents。
 ## 安裝
 
 ```bash
-npx @topy-ai/maggie@0.7.22 init --agent all
+npx @topy-ai/maggie@0.7.23 init --agent all
 npx @topy-ai/maggie doctor --project .
 ```
 
@@ -25,7 +25,9 @@ maggie doctor --project . --require-bootstrap --strict
 deployment、memory、feedback 和 MaggieDash。內容先 draft/review，外部寫入、
 publish 與 production deployment 需要明確確認。
 
-0.7.22 加入 provider catalogue authority check、field/variant sync report、
+0.7.23 加入 dashboard dialog 單一 scroll owner、server runtime-only auth/provider
+設定規則、optional identity mirror 的 best-effort 邊界，以及 QA 的
+`scroll-owner-count` browser evidence。0.7.22 加入 provider catalogue authority check、field/variant sync report、
 supply/display lifecycle state、site-owned slug proposal、withdrawal ending、
 retirement evidence audit，以及 runtime QA assertion lint。
 0.7.21 增加 localization polish/rewrite 的 operation-specific quality checks、

package/bundled-contracts/maggiedash/auth-model.md

@@ -19,6 +19,17 @@ and passwordless login are not supported by this contract.
 - Every project request must check membership and role after session
   validation; a valid account alone does not grant project access.
 
+## Runtime configuration boundary
+
+The host adapter reads database, session, and external identity-provider
+settings from server runtime configuration. Private settings must not come
+from browser/public environment variables, dashboard props, or client bundles.
+The primary provider session is the source of truth for the login response.
+An optional local identity/profile mirror may run afterward, but missing mirror
+tables or temporary mirror failures must not reject an otherwise valid session.
+Hosts that require the mirror must declare that requirement in their adapter
+contract and test its failure path separately.
+
 ## Local fixture adapter
 
 `tools/runtime/maggie_auth.py` provides a dependency-free SQLite fixture. It

package/bundled-references/maggiedash-integration.md

@@ -29,6 +29,10 @@ in environment variables and are never copied into reports.
 - Auth is traditional email/password with verified email, Argon2id production
   hashing, server-side sessions, project membership, and audit events. Passkey,
   WebAuthn, and passwordless login are not supported.
+- Auth and provider configuration are server-runtime-only. An optional local
+  identity/profile mirror runs after the primary session and cannot turn a
+  successful provider login into a generic failure unless the host contract
+  explicitly declares that mirror required.
 - API Pull, booking, analytics, email, and deployment providers expose health,
   normalized errors, and explicit configuration schemas.
 

package/bundled-skills/maggie-auth-reference/SKILL.md

@@ -2,7 +2,7 @@
 name: maggie-auth-reference
 description: Generate and validate a provider-neutral traditional email/password auth reference with secure server sessions and production security gates.
 metadata:
-  version: 1.0.0
+  version: 1.1.0
 ---
 
 Before and after a meaningful auth-reference run, follow the shared
@@ -26,3 +26,16 @@ HttpOnly/SameSite server-side sessions, generic failed-login responses,
 throttling, lockout, revocation, and an explicit owner setup gate. Secrets,
 hashes, and session tokens must never be emitted into browser responses,
 logs, or project context.
+
+## Runtime provider boundary
+
+Read database, session, and external identity-provider settings inside the
+server route from the deployment platform's runtime configuration. Do not use
+browser/public environment variables for private settings, and do not pass
+provider credentials through dashboard props or client bundles.
+
+If a host also mirrors an authenticated identity into a local user/profile
+table, run that mirror after the primary provider session succeeds. A missing
+optional table or temporary mirror failure must be a safe, redacted warning and
+must not reject a valid primary session. Make the mirror blocking only when the
+host has explicitly documented it as part of the authentication contract.

package/bundled-skills/maggie-design/SKILL.md

@@ -303,6 +303,9 @@ shell is reconciled. Record:
   responsive changes, comparing every value with the homepage tokens;
 - hover, focus, open, loading, empty, error, scroll, tab, and reduced-motion
   behavior;
+- each modal or drawer has one intentional scroll owner. Lock the page/app
+  shell while it is open, contain the backdrop, and let only the content area
+  scroll when the dialog is taller than the viewport;
 - required assets and their reuse/licensing notes;
 - page metadata and whether the page is a marketing route, conversion route,
   or actual blog content.

package/bundled-skills/maggie-qa-workflow/SKILL.md

@@ -2,7 +2,7 @@
 name: maggie-qa-workflow
 description: Run scenario-based browser QA with explicit evidence, fix/retest lifecycle, and release-gate decisions for web projects.
 metadata:
-  version: 1.0.0
+  version: 1.1.0
 ---
 
 # Maggie QA Workflow
@@ -89,7 +89,9 @@ maggie qa assertion-audit --project . \
 The `maggie.qa-assertions.v1` manifest requires a route, `transport: "http"`,
 HTTP status evidence, a screenshot/reference, and boolean results for runtime
 checks such as `text-present`, `text-absent`, `meta`, `link-absent`, or
-`redirect`. Source/class/markup-only checks are rejected. The audit stores
+`redirect`. For dialogs and drawers, `scroll-owner-count` records the browser
+runtime's computed number of intentional scroll owners and must use
+`expected: 1`. Source/class/markup-only checks are rejected. The audit stores
 assertion IDs and safe pass/fail metadata, never response bodies, credentials,
 or cookies. A passing assertion audit complements browser evidence; it does
 not replace the host adapter's actual HTTP and screenshot capture.

package/bundled-tools/clis/maggie_qa_workflow.py

@@ -23,7 +23,7 @@ DEFAULT_SCENARIOS = Path(".maggie") / "scenario-manifest.json"
 VALID_STATUSES = {"pending", "pass", "fail", "blocked", "inconclusive"}
 VALID_PHASES = {"test", "fix", "retest"}
 ASSERTION_SCHEMA = "maggie.qa-assertions.v1"
-RUNTIME_ASSERTION_TYPES = {"http-status", "final-url", "text-present", "text-absent", "meta", "link-absent", "redirect"}
+RUNTIME_ASSERTION_TYPES = {"http-status", "final-url", "text-present", "text-absent", "meta", "link-absent", "redirect", "scroll-owner-count"}
 SOURCE_ASSERTION_TYPES = {"class-present", "class-absent", "markup-present", "markup-absent", "source-text"}
 SECRET_RE = re.compile(
     r"(?i)(bearer\s+|(?:api[_-]?key|token|secret|password|authorization|cookie)\s*[=:]\s*)[^\s,;]+"
@@ -377,6 +377,13 @@ def assertion_audit(args: argparse.Namespace) -> int:
                 item_errors.append(f"checks[{check_index}].passed must be boolean evidence")
             if check_type == "http-status" and isinstance(evidence_data.get("httpStatus"), int) and check.get("actual") != evidence_data["httpStatus"]:
                 item_errors.append(f"checks[{check_index}] actual status does not match evidence.httpStatus")
+            if check_type == "scroll-owner-count":
+                if not isinstance(check.get("actual"), int) or isinstance(check.get("actual"), bool):
+                    item_errors.append(f"checks[{check_index}].actual must be an integer scroll-owner count")
+                if check.get("expected") != 1:
+                    item_errors.append(f"checks[{check_index}].expected must be 1 scroll owner")
+                if isinstance(check.get("actual"), int) and not isinstance(check.get("actual"), bool) and check.get("actual") != 1:
+                    item_errors.append(f"checks[{check_index}] found more or fewer than one scroll owner")
         if any(isinstance(check, dict) and check.get("passed") is False for check in checks):
             item_errors.append("one or more runtime checks failed")
         audited.append({"id": identifier, "passed": not item_errors, "errors": item_errors})

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@topy-ai/maggie",
-  "version": "0.7.22",
+  "version": "0.7.23",
   "description": "Install and manage Maggie Skills for AI coding agents",
   "license": "MIT",
   "type": "module",

package/references/maggiedash-integration.md

@@ -29,6 +29,10 @@ in environment variables and are never copied into reports.
 - Auth is traditional email/password with verified email, Argon2id production
   hashing, server-side sessions, project membership, and audit events. Passkey,
   WebAuthn, and passwordless login are not supported.
+- Auth and provider configuration are server-runtime-only. An optional local
+  identity/profile mirror runs after the primary session and cannot turn a
+  successful provider login into a generic failure unless the host contract
+  explicitly declares that mirror required.
 - API Pull, booking, analytics, email, and deployment providers expose health,
   normalized errors, and explicit configuration schemas.